CVE-2026-96740
Medium
Description
A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.
SeverityMedium
CVSS6.5
Exploit probability—
Product
StreamsHub Console for Apache Kafka®
PublishedSep 28, 2026
First seenSep 28, 2026
Weakness typeCWE-470CWE-470
How to fix
Update
- Red Hat StreamsHub Console for Apache Kafka®0.12.9, 0.14.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat StreamsHub Console for Apache Kafka® | 0.2.1 ≤ v < 0.12.9, 0.13.0 ≤ v < 0.14.1 | 0.12.9, 0.14.1 |
| Red Hat streams for Apache Kafka 3 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.